PT-2007-1388 · Drupal · Imce

Publicado 2007-03-05 · Atualizado 2017-07-29 · CVE-2006-7110

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions IMCE versions prior to 1.6

Description A directory traversal issue exists in the delete function of the IMCE Drupal module, allowing remote authenticated users to delete arbitrary files by utilizing ".." sequences in the input.

Recommendations For versions prior to 1.6, update to version 1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the delete function in IMCE to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-7110

Produtos afetados

Imce

Referências · 6

• http://drupal.org/node/87101 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-7110 · Nota de Segurança
• http://vupen.com/english/advisories/2006/3892 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29324 · Nota
• http://securityfocus.com/bid/20312 · Aviso do Fabricante
• http://secunia.com/advisories/22261 · Aviso do Fabricante